Identity and zero trust
Everything I've written on identity and zero trust, with the research pieces first. Each one ends with something you can do on Monday.
Dealing with one of these problems yourself? I work with organizations that need answers, not another slide deck. Let's talk.
What's in a five-angle short
Most subjects here are one page with five short sections, always in this order. Each has its own colour inside the article so you can jump to the one you need.
- 1Where I'd start: the first move I'd make, and the question I'd ask before spending anything.
- 2Where plans fail: where plans on this subject usually break, and the assumption I'd test first.
- 3Beyond the jargon: what the subject actually means once the vendor language is stripped out.
- 4What good looks like: the result that would tell you it worked, and the number I'd watch.
- 5The call leaders can't dodge: the decision leadership has to own, and what it needs on the table to make it.
-
Does Privileged Access Really End When the Timer Expires?
Verify that temporary admin access ends across role assignments, cached decisions, sessions and delegated credentials while ordinary access keeps working.
-
How Do You Prove SaaS Access Has Ended After Offboarding?
Verify SaaS offboarding across accounts, sessions, tokens, integrations and shared content, with evidence of effective denial and explicit limits.
-
How Should Account Recovery Work with Phishing-Resistant MFA?
Design account recovery that verifies the claimant, constrains replacement enrollment, and ends old access without quietly weakening phishing-resistant MFA.
-
How Should Passkey Recovery Work on Shared Workplace Devices?
Design passkey recovery for shared terminals without leaving credentials, sessions or data for the next worker. Includes recovery gates and shift-change tests.
-
What Should Zero trust Do When the Policy Service Is Down?
Design zero-trust access during policy-service outages: bound cached decisions, separate denial from errors, preserve essential work and verify recovery.
-
Who Should Own Cloud Workload Identities?
Assign responsibility for workload identity issuance, permissions and retirement, then verify who can obtain credentials and which access actually ends.
-
Access reviews
I would not begin access reviews by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
Break-glass accounts: the exception that becomes the breach
Every environment needs a way in when everything else fails. Every environment I've seen has at least one such account that's been used for something other t...
-
Conditional access
I would not begin conditional access by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Device trust
I would not begin device trust by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenario ...
-
Identity federation
I would not begin identity federation by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sc...
-
Identity incident response
I would not begin identity incident response by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and...
-
Least privilege
I would not begin least privilege by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenar...
-
MFA resilience
I would not begin MFA resilience by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scenari...
-
Privileged access
I would not begin privileged access by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one scen...
-
Service identities
I would not begin service identities by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and one sce...
-
Who Can Actually Shut Down a Compromised Account?
The team sees the compromised account, but nobody can shut it down.
-
Zero trust That Works After the Slide Deck Is Gone
Somewhere in almost every large organization, there's a beautiful zero-trust architecture diagram that has never had to survive an ordinary Tuesday. The arro...
-
Zero trust architecture
I would not begin zero trust architecture by buying another platform or launching a large programme. I would find the boundary, the accountable owner, and on...
Nothing matches. Try another word, or ask me directly.